This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to translate text contained within the image.
The module doesn't sufficiently sanitize the SVG file before embedding it into the html.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files, and the permission to use a text format that includes the SVG embed filter.
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.
The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.
This module enables you to manage blocks from specific modules in the specific themes.
The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/{plugin_id}/{theme}" (route "block.admin_add"). The attacker can add the block to the theme where they can't manage blocks.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks provided by [provider]".
This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure.
A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant access to content, it may grant more access than was intended.
This vulnerability is only present in sites that have custom code calling the mm_content_get_uids_in_group() function with a single UID of zero (0) in the second parameter.
This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions.
The module doesn't sufficiently check revision access before rendering a diff report for 1) nodes or 2) general entities that support diff.
This module enables you to store and manage both private and public files, provides the ability to add fieldable metadata for file_entity bundle types in addition to core file_managed data.
The module doesn't sufficiently ensure that folders exist within the private destination prior to writing to them. If the subfolder doesn't exist, the module places the file in a publicly accessible directory.
This vulnerability only affects sites with private files.
This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers.
The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data.
Open Social is a Drupal distribution for online communities.
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
Open Social is a Drupal distribution for online communities, which ships with an optional module called Social Embed.
This module allows a website to display embedded content (such as photos or videos) when a user posts a link to that resource, without having to parse the resource directly.
Added URL's were not sufficiently validated which could lead to a DoS via Blind SSRF and/or Application Takeover via Stored XSS.
This vulnerability is mitigated by the fact that social_embed submodule needs to be enabled.
This module enables field collections to be displayed as tables. It supports display suite and field permissions and provides operations (modify, delete, duplicate).
This module has multiple vulnerabilities due to the requirements on the routes it provides not being restrictive enough.
Information disclosure
Several routes only checked for the 'access content' permission before displaying a paragraph, and did not check whether the user should actually have access to view the paragraph in question.
This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another entity of the same type and bundle.
The module doesn't properly check the user access to the original entity, allowing users to create a new entity (they have permission to create) pre-filled with content from another entity of the same type and bundle that they would normally not have access to.
This vulnerability is mitigated by the fact that an attacker must have the permission to create content of the type of the entity to clone.
This module enables you to configure a wiki-like input filter that allows users to create links to site and external content.
The module doesn't sufficiently check if a user has access to some URLs before rendering them as links.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access content" (which is commonly assigned to all roles), and the site must be configured to disallow access to certain content.
This module enables you to cache pages for logged in users at the Varnish level.
The Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when guessing such a bin name.
The Opigno module is related to Opigno LMS distribution. Opigno Scorm submodule exposes an API for extracting and handling SCORM packages.
Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it affected only specific activity types.
The Opigno TinCan Question Type module is related to Opigno LMS distribution. The module adds a new question type for the Quiz module. With this new question type, you will be able to import TinCan Packages to your Drupal instance and to use it as a question.
Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission to create or edit "TinCan Package" content type.
This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths.
The module doesn't respect custom node access restrictions implemented through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes can appear in the menu.
Only sites with modules that implement hook_ENTITY_TYPE_access to restrict access to nodes are effected.
The Opigno Learning Path module enables you to manage group content.
Administrative forms allow uploading malicious files which may contain arbitrary code (RCE) or cross site scriptiong (XSS). These forms were not adequately controlled with permissions that communicate the severity of the permission.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Manage group content in any group".
The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training.
In the opigno_module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission "create opigno tincan activities".
The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one.
An administration form allows execution of arbitrary code.
This issue is mitigated by several factors. First, it requires the attacker have the permission "update group learning_path". Additionally, it requires several steps and depends on other data in the system to be in place.
The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes.
The module doesn't validate the content of classes. A malicious user with access to the View Password Settings Form could add malicious code in the classes field.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer view password".
Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance.
The Migrate queue importer module enables you to create cron migrations(configuration entities) with a reference towards migration entities in order to import them during cron runs.
The module doesn't sufficiently protect against Cross Site Request Forgery
under specific scenarios allowing an attacker to enable/disable a cron migration.
This vulnerability is mitigated by the fact that an attacker must know the
id of the migration.
Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider Authentication, etc.
The module doesn't sufficiently control user access when using Basic Authentication.
The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form.
The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is used.
This vulnerability is mitigated by the fact that it requires the "Email contact link" formatter to be used.
The Rest views module lets site admins create rest exports in views with additional options for serializing data.
This module does not accurately check access and may expose paths to unpublished content.
This vulnerability is mitigated by the fact that there must be a specific content structure to expose.
Paths to unpublished entities (such as nodes) will be exposed if those entities are referenced from other entities listed in a REST display, and the reference field on those listed entities is displayed with the "Entity path" formatter.
Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications.
This module doesn't sufficiently protect access to the settings form, allowing an unauthorized malicious user to view and modify the module settings.
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620.
This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
The Registration role module lets an administrator select a role (or multiple roles) to automatically assign to new users. The selected role (or roles) will be assigned to new registrants.
The module has a logic error when handling sites that upgraded code and did not run the Drupal update process (e.g. update.php).
This vulnerability is mitigated by the fact that the problem does not exist on sites that followed the process of updating code and running the standard updates.
This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission.
The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Access private content".
The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that on certain configurations may impact the Drupal module that bundles and integrates this code.
The vulnerability is mitigated by the fact it requires:
The Migrate Tools module provides tools for running and managing Drupal migrations.
The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to trick an authenticated administrator into initiating a migration.
This vulnerability is mitigated by the fact that an attacker must know the name of the migration.
The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides.
The module could allow an attacker to gain widespread access to a Drupal site. This vulnerability is mitigated by the fact that an attacker must have a means to trigger sending an email with a body that they can control, which would requires either another contributed module or custom integration.
Open Social is a Drupal distribution for online communities.
The included optional social_group_flexible_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended.
This vulnerability is mitigated by the fact the module social_group_flexible_group needs to be enabled.
Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed.
This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level.
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.
In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled.
This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin.
